vgsp-gr: move win0 shadow pool clear of the data bounce window (matmul C rows 0..31)

m150 grew the GR data bounce window to 208 pages at main-PT slots
0x110..0x1df but left the win0 QMD shadow pool at VA 0x190000 (slots
0x190..0x197) - inside the new window. The win0 plant is unconditional on
every gsp_phys_rmcall_pdb_build() and runs after the one-shot bounce
plant, so it hijacked the PTEs for bounce pages 128..135, which hold the
first 8 pages of the third operand. victory_matmul's C rows 0..31
(8 pages x 256 floats = 8192 elements) were written into the shadow pages
and lost: MATMUL bad=8192, copy-out '56 changed by engine (first bi 136)'.

Move GSP_PHYS_RMCALL_VA_GR_SHADOW0_BASE to 0x1e0000 (slots 0x1e0..0x1e7),
directly above the last bounce/mail/marker page (0x1df000) and below the
0x200000 guest scratch window; both the plant and the launch-time shadow
VA derive from the macro. Add a static_assert so any future bounce growth
cannot silently re-introduce the overlap, and correct the stale slot-range
comments/logs (0x108..0x10f -> the current range).

Evidence: /tmp/opencode/dmesg-r143-mailmatmul.log (main PT[190..197] =
win0 chunk DMAs; 'window[160] reloc=0x1b0000 changed=1', 'window[128]
reloc=0x190000 changed=0'; MATMUL bad=8192). Live validation pending: a
fresh cycle's victory_matmul must print bad=0 STATUS OK.

1 files changed, 32 insertions, 10 deletions

diff --git a/kernel/gsp_phys_booter.c b/kernel/gsp_phys_booter.c
index 110731d..f83899d 100644
--- a/kernel/gsp_phys_booter.c
+++ b/kernel/gsp_phys_booter.c
@@ -999,15 +999,23 @@ bool gsp_phys_boot_requested(void)
 #define GSP_PHYS_RMCALL_VA_DST		(GSP_PHYS_RMCALL_VA_BASE + 3 * GSP_PHYS_PAGE_SIZE)
 #define GSP_PHYS_RMCALL_VA_SEM		(GSP_PHYS_RMCALL_VA_BASE + 4 * GSP_PHYS_PAGE_SIZE)
 /*
- * m69: window-0 shadow pool - 8 module pages at VAs 0x108000..0x10f000
- * (small-PT slots 0x108..0x10f, the same 128 B PTE fetch line as the
- * GPFIFO/PB/QMDWIN slots, planted before the engine's first fetch). The
- * Tier-2 copies of the QMD's program/param pages are placed here so the GR
- * engine never has to read through the window-1 scratch VA range whose PT
- * chain (DMA_UPDATE_PDE_2 pdeIndex=1) has never been proven engine-readable.
+ * m69: window-0 shadow pool - 8 module pages holding the Tier-2 copies of
+ * the QMD's program/param pages, so the GR engine never has to read through
+ * the window-1 scratch VA range whose PT chain (DMA_UPDATE_PDE_2
+ * pdeIndex=1) has never been proven engine-readable.
+ *
+ * The base MUST stay clear of the m114/m150 GR data bounce window
+ * (GSP_PHYS_RMCALL_GR_BOUNCE_VA0 .. +PAGES, main-PT slots 0x110..0x1df):
+ * this pool is re-planted on every gsp_phys_rmcall_pdb_build() while the
+ * bounce PTEs are a one-shot plant, so any overlap lets the later win0
+ * plant steal the bounce slots and the engine writes results into the
+ * shadow pages, losing them. 0x1e0000 (slots 0x1e0..0x1e7) sits directly
+ * above the last bounce/mail/marker page (0x1df000) and below the guest
+ * scratch window (0x200000). Keep it that way (see the static_assert next
+ * to the bounce constants).
  */
 #define GSP_PHYS_RMCALL_VA_GR_SHADOW0_BASE \
-	(GSP_PHYS_RMCALL_VA_BASE + 0x90000ULL)
+	(GSP_PHYS_RMCALL_VA_BASE + 0xE0000ULL)
 #define GSP_PHYS_RMCALL_GR_SHADOW0_SLOTS	8u
 /*
  * m99: engine-tree branches for identity-mapping the forwarded kernel's
@@ -2169,7 +2177,7 @@ static struct gsp_phys_boot_stage {
 	/*
 	 * m69: window-0 shadow pool (gsp_phys_rmcall_gr_shadow_win0=1).
 	 * Eight module pages whose PTEs are planted in the proven window-0
-	 * PT line at slots 0x108..0x10f (VAs 0x108000..0x10f000) by
+	 * PT (slots derive from GSP_PHYS_RMCALL_VA_GR_SHADOW0_BASE) by
 	 * gsp_phys_rmcall_pdb_build, before the engine's first fetch (same
 	 * pattern as the qmdwin slot). The launch copies the QMD's
 	 * program/param page content into them and rewrites the QMD pointers
@@ -2209,6 +2217,20 @@ static struct gsp_phys_boot_stage {
 #define GSP_PHYS_RMCALL_GR_BOUNCE_SLOT0	0x110u
 #define GSP_PHYS_RMCALL_GR_BOUNCE_VA0	0x110000ULL
 #define GSP_PHYS_RMCALL_GR_MAIL_SLOT	206u
+/*
+ * m150b: the win0 QMD shadow pool must never overlap the bounce window.
+ * The win0 plant runs on every pdb_build() (unconditional) and the bounce
+ * plant is one-shot, so an overlap silently hijacks bounce PTEs and the
+ * engine's results land in the shadow pages (victory_matmul lost C rows
+ * 0..31 exactly this way before 0x1e0000 moved the pool clear).
+ */
+static_assert(GSP_PHYS_RMCALL_VA_GR_SHADOW0_BASE +
+	      (u64)GSP_PHYS_RMCALL_GR_SHADOW0_SLOTS * GSP_PHYS_PAGE_SIZE <=
+	      GSP_PHYS_RMCALL_GR_BOUNCE_VA0 ||
+	      GSP_PHYS_RMCALL_VA_GR_SHADOW0_BASE >=
+	      GSP_PHYS_RMCALL_GR_BOUNCE_VA0 +
+	      (u64)GSP_PHYS_RMCALL_GR_BOUNCE_PAGES * GSP_PHYS_PAGE_SIZE,
+	      "win0 shadow pool must not overlap the GR data bounce window");
 	/* m99: guest data identity-map table branches (see the PD*_MAX block). */
 	struct gsp_phys_boot_chunk
 		rmcall_gr_data_pd1[GSP_PHYS_RMCALL_GR_DATA_PD1_MAX];
@@ -9399,7 +9421,7 @@ static void gsp_phys_rmcall_pdb_build(void)
 		}
 	}
 	/*
-	 * m69: plant the window-0 shadow pool PTEs (slots 0x108..0x10f) in the
+	 * m69: plant the window-0 shadow pool PTEs (current win0 slot range) in the
 	 * same proven small-PT line, before the engine's first fetch. The
 	 * launch copies the QMD's program/param page content into these pages
 	 * and rewrites the QMD pointers to these VAs, so the GR engine never
@@ -9445,7 +9467,7 @@ static void gsp_phys_rmcall_pdb_build(void)
 					(size_t)idx * 8);
 			}
 			dma_wmb();
-			pr_info("vgsp-boot: rm-call: shadow-win0 pool planted %u pages at VA 0x%llx..0x%llx (small-PT slots 0x108..0x10f, before first fetch)\n",
+			pr_info("vgsp-boot: rm-call: shadow-win0 pool planted %u pages at VA 0x%llx..0x%llx (small-PT slots 0x1e0..0x1e7, before first fetch)\n",
 				GSP_PHYS_RMCALL_GR_SHADOW0_SLOTS,
 				GSP_PHYS_RMCALL_VA_GR_SHADOW0_BASE,
 				GSP_PHYS_RMCALL_VA_GR_SHADOW0_BASE +